CVE-2022-50666 Details
Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix QP destroy to wait for all references dropped. Delay QP destroy completion until all siw references to QP are dropped. The calling RDMA core will free QP structure after successful return from siw_qp_destroy() call, so siw must not hold any remaining reference to the QP upon return. A use-after-free was encountered in xfstest generic/460, while testing NFSoRDMA. Here, after a TCP connection drop by peer, the triggered siw_cm_work_handler got delayed until after QP destroy call, referencing a QP which has already freed.
A use-after-free vulnerability has been identified in the Linux kernel's RDMA/siw component, specifically within the handling of Queue Pair (QP) destruction. This issue arises because the QP destroy process does not wait for all references to be released, leading to a situation where a QP can be accessed after it has been freed. The vulnerability was discovered during testing of NFSoRDMA, where a delayed response to a TCP connection drop resulted in a reference to a QP that had already been deallocated.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Dec 9, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/0ed8bf9d0bb19f3f5eedd73f04aaf5bba9ac0737 | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/5c75d608fad58301b63e7d69200c13c3a1d411da | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/74ad141e995a730760b1bcfa14854b7f1057d6bc | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/a3c278807a459e6f50afee6971cabe74cccfb490 | kernel.org | Source CodeVendor |
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
| Product | Versions |
|---|---|
| Linux kernel | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 4, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | kernel.org |
| Dec 9, 2025 | New CVE Received | kernel.org |